Package org.forgerock.openig.security

Class ServerTlsOptionsHeaplet

java.lang.Object

org.forgerock.openig.heap.GenericHeaplet

org.forgerock.openig.security.ClientTlsOptionsHeaplet

org.forgerock.openig.security.ServerTlsOptionsHeaplet

All Implemented Interfaces:

Heaplet

public class ServerTlsOptionsHeaplet
extends ClientTlsOptionsHeaplet

Creates and initializes server-side TLS options in a heap environment.

 
  {
    "type": "ServerTlsOptions",
    "config": {
      "sslContextAlgorithm"        : String                          [OPTIONAL]
      "keyManager"                 : list of KeyManager              [OPTIONAL]
      "trustManager"               : list of TrustManager            [OPTIONAL]
      "sslEnabledProtocols"        : list of enabled protocols       [OPTIONAL]
      "sslCipherSuites"            : list of cipher suites           [OPTIONAL]
      "alpn"                       : {
        "enabled"                  : boolean                         [OPTIONAL]
      }
      "clientAuth"                 : String                          [OPTIONAL]
    }
   }
  
 

The clientAuth represents the expected client authentication to be provided and determines the authentication negotiation between the client and server. Possible values are NONE (the default), REQUIRED and REQUEST. If this is configured to use REQUIRED or REQUEST then a trustManager must also be configured.

See ClientTlsOptionsHeaplet for a summary of other configuration options.

See Also:

ClientTlsOptionsHeaplet, ServerTlsOptions.ClientAuthentication

Field Summary

Fields inherited from class org.forgerock.openig.heap.GenericHeaplet

config, heap, name, object, qualified

Constructor Summary

Constructors

Constructor	Description
ServerTlsOptionsHeaplet()

Method Summary

Modifier and Type	Method	Description
Object	create()	Called to request the heaplet create an object.
protected ClientTlsOptions	tlsOptions(String algorithm, KeyManager[] keyManagers, TrustManager[] trustManagers, List<String> ciphers, List<String> protocols, boolean enableAlpn)	Factory method creating appropriate ClientTlsOptions.

Methods inherited from class org.forgerock.openig.heap.GenericHeaplet

create, destroy, endpointRegistry, evaluatedWithHeapProperties, expression, getConfig, getHeap, getSecretService, getType, meterRegistryHolder, start

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ServerTlsOptionsHeaplet

public ServerTlsOptionsHeaplet()

Method Detail

create

public Object create()
              throws HeapException

Description copied from class: GenericHeaplet

Called to request the heaplet create an object. Called by Heaplet.create(Name, JsonValue, Heap) after initializing the protected field members. Implementations should parse configuration but not acquire resources, start threads, or log any initialization messages. These tasks should be performed by the GenericHeaplet.start() method.

Overrides:

create in class ClientTlsOptionsHeaplet

Returns:

The created object.

Throws:

HeapException - if an exception occurred during creation of the heap object or any of its dependencies.

tlsOptions

protected final ClientTlsOptions tlsOptions(String algorithm,
                                            KeyManager[] keyManagers,
                                            TrustManager[] trustManagers,
                                            List<String> ciphers,
                                            List<String> protocols,
                                            boolean enableAlpn)
                                     throws HeapException

Description copied from class: ClientTlsOptionsHeaplet

Factory method creating appropriate ClientTlsOptions.

Overrides:

tlsOptions in class ClientTlsOptionsHeaplet

Parameters:

algorithm - the SSL context algorithm name

keyManagers - the array of KeyManagers to use

trustManagers - the array of TrustManagers to use

ciphers - the array of cipher suites to be enabled

protocols - the array of protocols to be enabled

enableAlpn - indicate if ALPN (Application Layer Protocol Negotiation, a TLS extension) enabled

Returns:

new ClientTlsOptions subtype

Throws:

HeapException - should there be a configuration error